1/* SPDX-License-Identifier: GPL-2.0 */ 2/* 3 * Security server interface. 4 * 5 * Author : Stephen Smalley, <sds@tycho.nsa.gov> 6 * 7 */ 8 9#ifndef _SELINUX_SECURITY_H_ 10#define _SELINUX_SECURITY_H_ 11 12#include <linux/compiler.h> 13#include <linux/dcache.h> 14#include <linux/magic.h> 15#include <linux/types.h> 16#include <linux/rcupdate.h> 17#include <linux/refcount.h> 18#include <linux/workqueue.h> 19#include "flask.h" 20#include "policycap.h" 21 22#define SECSID_NULL 0x00000000 /* unspecified SID */ 23#define SECSID_WILD 0xffffffff /* wildcard SID */ 24#define SECCLASS_NULL 0x0000 /* no class */ 25 26/* Identify specific policy version changes */ 27#define POLICYDB_VERSION_BASE 15 28#define POLICYDB_VERSION_BOOL 16 29#define POLICYDB_VERSION_IPV6 17 30#define POLICYDB_VERSION_NLCLASS 18 31#define POLICYDB_VERSION_VALIDATETRANS 19 32#define POLICYDB_VERSION_MLS 19 33#define POLICYDB_VERSION_AVTAB 20 34#define POLICYDB_VERSION_RANGETRANS 21 35#define POLICYDB_VERSION_POLCAP 22 36#define POLICYDB_VERSION_PERMISSIVE 23 37#define POLICYDB_VERSION_BOUNDARY 24 38#define POLICYDB_VERSION_FILENAME_TRANS 25 39#define POLICYDB_VERSION_ROLETRANS 26 40#define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS 27 41#define POLICYDB_VERSION_DEFAULT_TYPE 28 42#define POLICYDB_VERSION_CONSTRAINT_NAMES 29 43#define POLICYDB_VERSION_XPERMS_IOCTL 30 44#define POLICYDB_VERSION_INFINIBAND 31 45#define POLICYDB_VERSION_GLBLUB 32 46#define POLICYDB_VERSION_COMP_FTRANS 33 /* compressed filename transitions */ 47 48/* Range of policy versions we understand*/ 49#define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE 50#define POLICYDB_VERSION_MAX POLICYDB_VERSION_COMP_FTRANS 51 52/* Mask for just the mount related flags */ 53#define SE_MNTMASK 0x0f 54/* Super block security struct flags for mount options */ 55/* BE CAREFUL, these need to be the low order bits for selinux_get_mnt_opts */ 56#define CONTEXT_MNT 0x01 57#define FSCONTEXT_MNT 0x02 58#define ROOTCONTEXT_MNT 0x04 59#define DEFCONTEXT_MNT 0x08 60#define SBLABEL_MNT 0x10 61/* Non-mount related flags */ 62#define SE_SBINITIALIZED 0x0100 63#define SE_SBPROC 0x0200 64#define SE_SBGENFS 0x0400 65#define SE_SBGENFS_XATTR 0x0800 66 67#define CONTEXT_STR "context" 68#define FSCONTEXT_STR "fscontext" 69#define ROOTCONTEXT_STR "rootcontext" 70#define DEFCONTEXT_STR "defcontext" 71#define SECLABEL_STR "seclabel" 72 73struct netlbl_lsm_secattr; 74 75extern int selinux_enabled_boot; 76 77/* 78 * type_datum properties 79 * available at the kernel policy version >= POLICYDB_VERSION_BOUNDARY 80 */ 81#define TYPEDATUM_PROPERTY_PRIMARY 0x0001 82#define TYPEDATUM_PROPERTY_ATTRIBUTE 0x0002 83 84/* limitation of boundary depth */ 85#define POLICYDB_BOUNDS_MAXDEPTH 4 86 87struct selinux_avc; 88struct selinux_policy; 89 90struct selinux_state { 91#ifdef CONFIG_SECURITY_SELINUX_DISABLE 92 bool disabled; 93#endif 94#ifdef CONFIG_SECURITY_SELINUX_DEVELOP 95 bool enforcing; 96#endif 97 bool checkreqprot; 98 bool initialized; 99 bool policycap[__POLICYDB_CAPABILITY_MAX]; 100 101 struct page *status_page; 102 struct mutex status_lock; 103 104 struct selinux_avc *avc; 105 struct selinux_policy __rcu *policy; 106 struct mutex policy_mutex; 107} __randomize_layout; 108 109void selinux_avc_init(struct selinux_avc **avc); 110 111extern struct selinux_state selinux_state; 112 113static inline bool selinux_initialized(const struct selinux_state *state) 114{ 115 /* do a synchronized load to avoid race conditions */ 116 return smp_load_acquire(&state->initialized); 117} 118 119static inline void selinux_mark_initialized(struct selinux_state *state) 120{ 121 /* do a synchronized write to avoid race conditions */ 122 smp_store_release(&state->initialized, true); 123} 124 125#ifdef CONFIG_SECURITY_SELINUX_DEVELOP 126static inline bool enforcing_enabled(struct selinux_state *state) 127{ 128 return READ_ONCE(state->enforcing); 129} 130 131static inline void enforcing_set(struct selinux_state *state, bool value) 132{ 133 WRITE_ONCE(state->enforcing, value); 134} 135#else 136static inline bool enforcing_enabled(struct selinux_state *state) 137{ 138 return true; 139} 140 141static inline void enforcing_set(struct selinux_state *state, bool value) 142{ 143} 144#endif 145 146static inline bool checkreqprot_get(const struct selinux_state *state) 147{ 148 return READ_ONCE(state->checkreqprot); 149} 150 151static inline void checkreqprot_set(struct selinux_state *state, bool value) 152{ 153 WRITE_ONCE(state->checkreqprot, value); 154} 155 156#ifdef CONFIG_SECURITY_SELINUX_DISABLE 157static inline bool selinux_disabled(struct selinux_state *state) 158{ 159 return READ_ONCE(state->disabled); 160} 161 162static inline void selinux_mark_disabled(struct selinux_state *state) 163{ 164 WRITE_ONCE(state->disabled, true); 165} 166#else 167static inline bool selinux_disabled(struct selinux_state *state) 168{ 169 return false; 170} 171#endif 172 173static inline bool selinux_policycap_netpeer(void) 174{ 175 struct selinux_state *state = &selinux_state; 176 177 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_NETPEER]); 178} 179 180static inline bool selinux_policycap_openperm(void) 181{ 182 struct selinux_state *state = &selinux_state; 183 184 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_OPENPERM]); 185} 186 187static inline bool selinux_policycap_extsockclass(void) 188{ 189 struct selinux_state *state = &selinux_state; 190 191 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_EXTSOCKCLASS]); 192} 193 194static inline bool selinux_policycap_alwaysnetwork(void) 195{ 196 struct selinux_state *state = &selinux_state; 197 198 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_ALWAYSNETWORK]); 199} 200 201static inline bool selinux_policycap_cgroupseclabel(void) 202{ 203 struct selinux_state *state = &selinux_state; 204 205 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_CGROUPSECLABEL]); 206} 207 208static inline bool selinux_policycap_nnp_nosuid_transition(void) 209{ 210 struct selinux_state *state = &selinux_state; 211 212 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION]); 213} 214 215static inline bool selinux_policycap_genfs_seclabel_symlinks(void) 216{ 217 struct selinux_state *state = &selinux_state; 218 219 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]); 220} 221 222static inline bool selinux_policycap_ioctl_skip_cloexec(void) 223{ 224 struct selinux_state *state = &selinux_state; 225 226 return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC]); 227} 228 229struct selinux_policy_convert_data; 230 231struct selinux_load_state { 232 struct selinux_policy *policy; 233 struct selinux_policy_convert_data *convert_data; 234}; 235 236int security_mls_enabled(struct selinux_state *state); 237int security_load_policy(struct selinux_state *state, 238 void *data, size_t len, 239 struct selinux_load_state *load_state); 240void selinux_policy_commit(struct selinux_state *state, 241 struct selinux_load_state *load_state); 242void selinux_policy_cancel(struct selinux_state *state, 243 struct selinux_load_state *load_state); 244int security_read_policy(struct selinux_state *state, 245 void **data, size_t *len); 246 247int security_policycap_supported(struct selinux_state *state, 248 unsigned int req_cap); 249 250#define SEL_VEC_MAX 32 251struct av_decision { 252 u32 allowed; 253 u32 auditallow; 254 u32 auditdeny; 255 u32 seqno; 256 u32 flags; 257}; 258 259#define XPERMS_ALLOWED 1 260#define XPERMS_AUDITALLOW 2 261#define XPERMS_DONTAUDIT 4 262 263#define security_xperm_set(perms, x) (perms[x >> 5] |= 1 << (x & 0x1f)) 264#define security_xperm_test(perms, x) (1 & (perms[x >> 5] >> (x & 0x1f))) 265struct extended_perms_data { 266 u32 p[8]; 267}; 268 269struct extended_perms_decision { 270 u8 used; 271 u8 driver; 272 struct extended_perms_data *allowed; 273 struct extended_perms_data *auditallow; 274 struct extended_perms_data *dontaudit; 275}; 276 277struct extended_perms { 278 u16 len; /* length associated decision chain */ 279 struct extended_perms_data drivers; /* flag drivers that are used */ 280}; 281 282/* definitions of av_decision.flags */ 283#define AVD_FLAGS_PERMISSIVE 0x0001 284 285void security_compute_av(struct selinux_state *state, 286 u32 ssid, u32 tsid, 287 u16 tclass, struct av_decision *avd, 288 struct extended_perms *xperms); 289 290void security_compute_xperms_decision(struct selinux_state *state, 291 u32 ssid, u32 tsid, u16 tclass, 292 u8 driver, 293 struct extended_perms_decision *xpermd); 294 295void security_compute_av_user(struct selinux_state *state, 296 u32 ssid, u32 tsid, 297 u16 tclass, struct av_decision *avd); 298 299int security_transition_sid(struct selinux_state *state, 300 u32 ssid, u32 tsid, u16 tclass, 301 const struct qstr *qstr, u32 *out_sid); 302 303int security_transition_sid_user(struct selinux_state *state, 304 u32 ssid, u32 tsid, u16 tclass, 305 const char *objname, u32 *out_sid); 306 307int security_member_sid(struct selinux_state *state, u32 ssid, u32 tsid, 308 u16 tclass, u32 *out_sid); 309 310int security_change_sid(struct selinux_state *state, u32 ssid, u32 tsid, 311 u16 tclass, u32 *out_sid); 312 313int security_sid_to_context(struct selinux_state *state, u32 sid, 314 char **scontext, u32 *scontext_len); 315 316int security_sid_to_context_force(struct selinux_state *state, 317 u32 sid, char **scontext, u32 *scontext_len); 318 319int security_sid_to_context_inval(struct selinux_state *state, 320 u32 sid, char **scontext, u32 *scontext_len); 321 322int security_context_to_sid(struct selinux_state *state, 323 const char *scontext, u32 scontext_len, 324 u32 *out_sid, gfp_t gfp); 325 326int security_context_str_to_sid(struct selinux_state *state, 327 const char *scontext, u32 *out_sid, gfp_t gfp); 328 329int security_context_to_sid_default(struct selinux_state *state, 330 const char *scontext, u32 scontext_len, 331 u32 *out_sid, u32 def_sid, gfp_t gfp_flags); 332 333int security_context_to_sid_force(struct selinux_state *state, 334 const char *scontext, u32 scontext_len, 335 u32 *sid); 336 337int security_get_user_sids(struct selinux_state *state, 338 u32 callsid, char *username, 339 u32 **sids, u32 *nel); 340 341int security_port_sid(struct selinux_state *state, 342 u8 protocol, u16 port, u32 *out_sid); 343 344int security_ib_pkey_sid(struct selinux_state *state, 345 u64 subnet_prefix, u16 pkey_num, u32 *out_sid); 346 347int security_ib_endport_sid(struct selinux_state *state, 348 const char *dev_name, u8 port_num, u32 *out_sid); 349 350int security_netif_sid(struct selinux_state *state, 351 char *name, u32 *if_sid); 352 353int security_node_sid(struct selinux_state *state, 354 u16 domain, void *addr, u32 addrlen, 355 u32 *out_sid); 356 357int security_validate_transition(struct selinux_state *state, 358 u32 oldsid, u32 newsid, u32 tasksid, 359 u16 tclass); 360 361int security_validate_transition_user(struct selinux_state *state, 362 u32 oldsid, u32 newsid, u32 tasksid, 363 u16 tclass); 364 365int security_bounded_transition(struct selinux_state *state, 366 u32 oldsid, u32 newsid); 367 368int security_sid_mls_copy(struct selinux_state *state, 369 u32 sid, u32 mls_sid, u32 *new_sid); 370 371int security_net_peersid_resolve(struct selinux_state *state, 372 u32 nlbl_sid, u32 nlbl_type, 373 u32 xfrm_sid, 374 u32 *peer_sid); 375 376int security_get_classes(struct selinux_policy *policy, 377 char ***classes, int *nclasses); 378int security_get_permissions(struct selinux_policy *policy, 379 char *class, char ***perms, int *nperms); 380int security_get_reject_unknown(struct selinux_state *state); 381int security_get_allow_unknown(struct selinux_state *state); 382 383#define SECURITY_FS_USE_XATTR 1 /* use xattr */ 384#define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */ 385#define SECURITY_FS_USE_TASK 3 /* use task SIDs, e.g. pipefs/sockfs */ 386#define SECURITY_FS_USE_GENFS 4 /* use the genfs support */ 387#define SECURITY_FS_USE_NONE 5 /* no labeling support */ 388#define SECURITY_FS_USE_MNTPOINT 6 /* use mountpoint labeling */ 389#define SECURITY_FS_USE_NATIVE 7 /* use native label support */ 390#define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */ 391 392int security_fs_use(struct selinux_state *state, struct super_block *sb); 393 394int security_genfs_sid(struct selinux_state *state, 395 const char *fstype, char *name, u16 sclass, 396 u32 *sid); 397 398int selinux_policy_genfs_sid(struct selinux_policy *policy, 399 const char *fstype, char *name, u16 sclass, 400 u32 *sid); 401 402#ifdef CONFIG_NETLABEL 403int security_netlbl_secattr_to_sid(struct selinux_state *state, 404 struct netlbl_lsm_secattr *secattr, 405 u32 *sid); 406 407int security_netlbl_sid_to_secattr(struct selinux_state *state, 408 u32 sid, 409 struct netlbl_lsm_secattr *secattr); 410#else 411static inline int security_netlbl_secattr_to_sid(struct selinux_state *state, 412 struct netlbl_lsm_secattr *secattr, 413 u32 *sid) 414{ 415 return -EIDRM; 416} 417 418static inline int security_netlbl_sid_to_secattr(struct selinux_state *state, 419 u32 sid, 420 struct netlbl_lsm_secattr *secattr) 421{ 422 return -ENOENT; 423} 424#endif /* CONFIG_NETLABEL */ 425 426const char *security_get_initial_sid_context(u32 sid); 427 428/* 429 * status notifier using mmap interface 430 */ 431extern struct page *selinux_kernel_status_page(struct selinux_state *state); 432 433#define SELINUX_KERNEL_STATUS_VERSION 1 434struct selinux_kernel_status { 435 u32 version; /* version number of thie structure */ 436 u32 sequence; /* sequence number of seqlock logic */ 437 u32 enforcing; /* current setting of enforcing mode */ 438 u32 policyload; /* times of policy reloaded */ 439 u32 deny_unknown; /* current setting of deny_unknown */ 440 /* 441 * The version > 0 supports above members. 442 */ 443} __packed; 444 445extern void selinux_status_update_setenforce(struct selinux_state *state, 446 int enforcing); 447extern void selinux_status_update_policyload(struct selinux_state *state, 448 int seqno); 449extern void selinux_complete_init(void); 450extern int selinux_disable(struct selinux_state *state); 451extern void exit_sel_fs(void); 452extern struct path selinux_null; 453extern struct vfsmount *selinuxfs_mount; 454extern void selnl_notify_setenforce(int val); 455extern void selnl_notify_policyload(u32 seqno); 456extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm); 457 458extern void avtab_cache_init(void); 459extern void ebitmap_cache_init(void); 460extern void hashtab_cache_init(void); 461extern int security_sidtab_hash_stats(struct selinux_state *state, char *page); 462 463#endif /* _SELINUX_SECURITY_H_ */ 464